<!DOCTYPE html>
<html lang="en-US">
  <head>
    <meta charset="utf-8">
    <meta name="viewport" content="width=device-width,initial-scale=1">
    <title>Wireshark网络分析 | whoway</title>
    <meta name="description" content="Personal Blog Website">
    <link rel="icon" href="/images/photo.jpg">
  <link rel="manifest" href="/images/photo.jpg">
  <link rel="apple-touch-icon" href="/images/photo.jpg">
  <meta http-quiv="pragma" cotent="no-cache">
  <meta http-quiv="pragma" cotent="no-cache,must-revalidate">
  <meta http-quiv="expires" cotent="0">
    
    <link rel="preload" href="/assets/css/0.styles.0dbae9ec.css" as="style"><link rel="preload" href="/assets/js/app.c70e21ad.js" as="script"><link rel="preload" href="/assets/js/79.ef71713f.js" as="script"><link rel="prefetch" href="/assets/js/10.15222a53.js"><link rel="prefetch" href="/assets/js/100.7e0e5a86.js"><link rel="prefetch" href="/assets/js/101.efd59f25.js"><link rel="prefetch" href="/assets/js/102.dfbdc06c.js"><link rel="prefetch" href="/assets/js/103.d3ab2109.js"><link rel="prefetch" href="/assets/js/104.117957ef.js"><link rel="prefetch" href="/assets/js/105.046e8ff3.js"><link rel="prefetch" href="/assets/js/106.aebdc17d.js"><link rel="prefetch" href="/assets/js/107.248733c2.js"><link rel="prefetch" href="/assets/js/108.a2fecadc.js"><link rel="prefetch" href="/assets/js/109.35196857.js"><link rel="prefetch" href="/assets/js/11.770642f2.js"><link rel="prefetch" href="/assets/js/110.cf3d973c.js"><link rel="prefetch" href="/assets/js/111.f985889a.js"><link rel="prefetch" href="/assets/js/112.ad614f41.js"><link rel="prefetch" href="/assets/js/113.f666653c.js"><link rel="prefetch" href="/assets/js/114.c6c3f384.js"><link rel="prefetch" href="/assets/js/115.e51d3c2f.js"><link rel="prefetch" href="/assets/js/116.4f4b39f5.js"><link rel="prefetch" href="/assets/js/117.99352e11.js"><link rel="prefetch" href="/assets/js/118.c6ae6572.js"><link rel="prefetch" href="/assets/js/119.4ccbe778.js"><link rel="prefetch" href="/assets/js/12.042a92ff.js"><link rel="prefetch" href="/assets/js/120.edda1c4f.js"><link rel="prefetch" href="/assets/js/121.30a638ed.js"><link rel="prefetch" href="/assets/js/122.6efcefb1.js"><link rel="prefetch" href="/assets/js/123.91e6665b.js"><link rel="prefetch" href="/assets/js/124.f27e3d7e.js"><link rel="prefetch" href="/assets/js/125.c75712d5.js"><link rel="prefetch" href="/assets/js/126.ed756cce.js"><link rel="prefetch" href="/assets/js/127.2f06c74c.js"><link rel="prefetch" href="/assets/js/128.d5f6f30e.js"><link rel="prefetch" href="/assets/js/129.508b7eed.js"><link rel="prefetch" href="/assets/js/13.b5280c37.js"><link rel="prefetch" href="/assets/js/130.dc05f9aa.js"><link rel="prefetch" href="/assets/js/131.e0ba69b1.js"><link rel="prefetch" href="/assets/js/132.d79bcaa4.js"><link rel="prefetch" href="/assets/js/133.34acc01a.js"><link rel="prefetch" href="/assets/js/134.dabf64d5.js"><link rel="prefetch" href="/assets/js/135.ad90c915.js"><link rel="prefetch" href="/assets/js/136.dbb0074f.js"><link rel="prefetch" href="/assets/js/137.284ad365.js"><link rel="prefetch" href="/assets/js/138.a4b6856f.js"><link rel="prefetch" href="/assets/js/139.c9c1e20f.js"><link rel="prefetch" href="/assets/js/14.df02ba38.js"><link rel="prefetch" href="/assets/js/140.8b0a9269.js"><link rel="prefetch" href="/assets/js/141.9c7759c5.js"><link rel="prefetch" href="/assets/js/142.a4201a82.js"><link rel="prefetch" href="/assets/js/143.d7da6e8c.js"><link rel="prefetch" href="/assets/js/144.5e48e65d.js"><link rel="prefetch" href="/assets/js/145.a0e2633c.js"><link rel="prefetch" href="/assets/js/146.3c775f9b.js"><link rel="prefetch" href="/assets/js/147.22add89a.js"><link rel="prefetch" href="/assets/js/148.cfde1009.js"><link rel="prefetch" href="/assets/js/149.ffc835b5.js"><link rel="prefetch" href="/assets/js/15.fbdfc4ee.js"><link rel="prefetch" href="/assets/js/150.406c4b20.js"><link rel="prefetch" href="/assets/js/151.b2040eea.js"><link rel="prefetch" href="/assets/js/152.7bc65661.js"><link rel="prefetch" href="/assets/js/153.1d7c65e3.js"><link rel="prefetch" href="/assets/js/154.1309de49.js"><link rel="prefetch" href="/assets/js/155.81d3ee1f.js"><link rel="prefetch" href="/assets/js/156.154a4ef2.js"><link rel="prefetch" href="/assets/js/16.e5eb6147.js"><link rel="prefetch" href="/assets/js/17.57853c4a.js"><link rel="prefetch" href="/assets/js/18.cb9d7518.js"><link rel="prefetch" href="/assets/js/19.f354dc47.js"><link rel="prefetch" href="/assets/js/2.570d8a23.js"><link rel="prefetch" href="/assets/js/20.b5af7fad.js"><link rel="prefetch" href="/assets/js/21.0b1928fe.js"><link rel="prefetch" href="/assets/js/22.f78666de.js"><link rel="prefetch" href="/assets/js/23.29c3f366.js"><link rel="prefetch" href="/assets/js/24.6f596516.js"><link rel="prefetch" href="/assets/js/25.14067b60.js"><link rel="prefetch" href="/assets/js/26.74ba4989.js"><link rel="prefetch" href="/assets/js/27.13d60edd.js"><link rel="prefetch" href="/assets/js/28.9523cb32.js"><link rel="prefetch" href="/assets/js/29.8ec842e9.js"><link rel="prefetch" href="/assets/js/3.3fb3d2e0.js"><link rel="prefetch" href="/assets/js/30.805597a8.js"><link rel="prefetch" href="/assets/js/31.831b195d.js"><link rel="prefetch" href="/assets/js/32.063c672d.js"><link rel="prefetch" href="/assets/js/33.6d93fac3.js"><link rel="prefetch" href="/assets/js/34.56e8263c.js"><link rel="prefetch" href="/assets/js/35.dbe688bb.js"><link rel="prefetch" href="/assets/js/36.dc5af2c1.js"><link rel="prefetch" href="/assets/js/37.0a7494f6.js"><link rel="prefetch" href="/assets/js/38.fe4fc171.js"><link rel="prefetch" href="/assets/js/39.f5ed5e92.js"><link rel="prefetch" href="/assets/js/4.2c405ec8.js"><link rel="prefetch" href="/assets/js/40.fe7e2714.js"><link rel="prefetch" href="/assets/js/41.30b0811d.js"><link rel="prefetch" href="/assets/js/42.76f52d62.js"><link rel="prefetch" href="/assets/js/43.e7bb0817.js"><link rel="prefetch" href="/assets/js/44.ead0e883.js"><link rel="prefetch" href="/assets/js/45.235df046.js"><link rel="prefetch" href="/assets/js/46.5f09e829.js"><link rel="prefetch" href="/assets/js/47.67116354.js"><link rel="prefetch" href="/assets/js/48.31f34543.js"><link rel="prefetch" href="/assets/js/49.10b5ebba.js"><link rel="prefetch" href="/assets/js/5.6f47322c.js"><link rel="prefetch" href="/assets/js/50.c0f0b7f1.js"><link rel="prefetch" href="/assets/js/51.5143f3bf.js"><link rel="prefetch" href="/assets/js/52.eeddfd48.js"><link rel="prefetch" href="/assets/js/53.eb790db5.js"><link rel="prefetch" href="/assets/js/54.8fe5421c.js"><link rel="prefetch" href="/assets/js/55.d8f9004b.js"><link rel="prefetch" href="/assets/js/56.62ac9b92.js"><link rel="prefetch" href="/assets/js/57.a9caec0d.js"><link rel="prefetch" href="/assets/js/58.f93fc522.js"><link rel="prefetch" href="/assets/js/59.a81a03aa.js"><link rel="prefetch" href="/assets/js/6.8c2ea393.js"><link rel="prefetch" href="/assets/js/60.ab782775.js"><link rel="prefetch" href="/assets/js/61.6dd12daf.js"><link rel="prefetch" href="/assets/js/62.76f4b01f.js"><link rel="prefetch" href="/assets/js/63.6f8a4742.js"><link rel="prefetch" href="/assets/js/64.6f8bb1fa.js"><link rel="prefetch" href="/assets/js/65.4120a44b.js"><link rel="prefetch" href="/assets/js/66.360c2d2b.js"><link rel="prefetch" href="/assets/js/67.26f84d32.js"><link rel="prefetch" href="/assets/js/68.68f45e5e.js"><link rel="prefetch" href="/assets/js/69.e311eb56.js"><link rel="prefetch" href="/assets/js/7.6762b2d7.js"><link rel="prefetch" href="/assets/js/70.cea82674.js"><link rel="prefetch" href="/assets/js/71.783ddcf7.js"><link rel="prefetch" href="/assets/js/72.e5467385.js"><link rel="prefetch" href="/assets/js/73.b8fb681b.js"><link rel="prefetch" href="/assets/js/74.1bae37db.js"><link rel="prefetch" href="/assets/js/75.024387e5.js"><link rel="prefetch" href="/assets/js/76.a8e53010.js"><link rel="prefetch" href="/assets/js/77.8c55500a.js"><link rel="prefetch" href="/assets/js/78.7ce90bf5.js"><link rel="prefetch" href="/assets/js/8.788a6364.js"><link rel="prefetch" href="/assets/js/80.acad589d.js"><link rel="prefetch" href="/assets/js/81.02670d10.js"><link rel="prefetch" href="/assets/js/82.53b7b1ac.js"><link rel="prefetch" href="/assets/js/83.99eb8581.js"><link rel="prefetch" href="/assets/js/84.d1535ce3.js"><link rel="prefetch" href="/assets/js/85.fe2b7de9.js"><link rel="prefetch" href="/assets/js/86.41850272.js"><link rel="prefetch" href="/assets/js/87.1cdc6df9.js"><link rel="prefetch" href="/assets/js/88.01bf3461.js"><link rel="prefetch" href="/assets/js/89.17c69819.js"><link rel="prefetch" href="/assets/js/9.3813842d.js"><link rel="prefetch" href="/assets/js/90.f6ae7e35.js"><link rel="prefetch" href="/assets/js/91.507bc284.js"><link rel="prefetch" href="/assets/js/92.90551782.js"><link rel="prefetch" href="/assets/js/93.dc442d78.js"><link rel="prefetch" href="/assets/js/94.315f4e94.js"><link rel="prefetch" href="/assets/js/95.ccd6c6bf.js"><link rel="prefetch" href="/assets/js/96.0c6d89d0.js"><link rel="prefetch" href="/assets/js/97.1a9f10a9.js"><link rel="prefetch" href="/assets/js/98.43be3caa.js"><link rel="prefetch" href="/assets/js/99.54c8207b.js">
    <link rel="stylesheet" href="/assets/css/0.styles.0dbae9ec.css">
  </head>
  <body>
    <div id="app" data-server-rendered="true"><div class="theme-container"><header class="navbar"><div class="sidebar-button"><svg xmlns="http://www.w3.org/2000/svg" aria-hidden="true" role="img" viewBox="0 0 448 512" class="icon"><path fill="currentColor" d="M436 124H12c-6.627 0-12-5.373-12-12V80c0-6.627 5.373-12 12-12h424c6.627 0 12 5.373 12 12v32c0 6.627-5.373 12-12 12zm0 160H12c-6.627 0-12-5.373-12-12v-32c0-6.627 5.373-12 12-12h424c6.627 0 12 5.373 12 12v32c0 6.627-5.373 12-12 12zm0 160H12c-6.627 0-12-5.373-12-12v-32c0-6.627 5.373-12 12-12h424c6.627 0 12 5.373 12 12v32c0 6.627-5.373 12-12 12z"></path></svg></div> <a href="/" class="home-link router-link-active"><!----> <span class="site-name">whoway</span></a> <div class="links" style="max-width:nullpx;"><div class="search-box"><input aria-label="Search" autocomplete="off" spellcheck="false" value=""> <!----></div> <nav class="nav-links can-hide"><div class="nav-item"><div class="dropdown-wrapper"><a class="dropdown-title"><span class="title">🎓Coding</span> <span class="arrow right"></span></a> <ul class="nav-dropdown" style="display:none;"><li class="dropdown-item"><!----> <a href="/00.Coding/TheBeautyOfProgramming/" class="nav-link">🔖编程之美题解</a></li><li class="dropdown-item"><!----> <a href="/00.Coding/CodeWarehouse/" class="nav-link">🔖代码意识流</a></li></ul></div></div><div class="nav-item"><div class="dropdown-wrapper"><a class="dropdown-title"><span class="title">🚀语言</span> <span class="arrow right"></span></a> <ul class="nav-dropdown" style="display:none;"><li class="dropdown-item"><!----> <a href="/01.Language/Overview/" class="nav-link">🔖概述</a></li><li class="dropdown-item"><!----> <a href="/01.Language/C/" class="nav-link">⭐️C</a></li><li class="dropdown-item"><!----> <a href="/01.Language/Cpp/" class="nav-link">🚀C++</a></li><li class="dropdown-item"><!----> <a href="/01.Language/Java/" class="nav-link">☕️Java</a></li><li class="dropdown-item"><!----> <a href="/01.Language/Python/" class="nav-link">🧩Python3</a></li></ul></div></div><div class="nav-item"><a href="/02.Hardware/" class="nav-link">✔️硬件基础</a></div><div class="nav-item"><div class="dropdown-wrapper"><a class="dropdown-title"><span class="title">⭐️软件基础</span> <span class="arrow right"></span></a> <ul class="nav-dropdown" style="display:none;"><li class="dropdown-item"><!----> <a href="/03.Software/01.DataStructureAndAlgorithm/" class="nav-link">🐾数据结构和算法</a></li><li class="dropdown-item"><!----> <a href="/03.Software/02.OS/" class="nav-link">💻操作系统</a></li><li class="dropdown-item"><!----> <a href="/03.Software/03.Net/" class="nav-link router-link-active">☁️计算机网络</a></li><li class="dropdown-item"><!----> <a href="/03.Software/04.SE/" class="nav-link">✅软件工程</a></li></ul></div></div><div class="nav-item"><a href="/04.Database/" class="nav-link">🎨数据库</a></div><div class="nav-item"><a href="/05.Engineer/" class="nav-link">🔖学术/工程</a></div><div class="nav-item"><div class="dropdown-wrapper"><a class="dropdown-title"><span class="title">⚙️工具</span> <span class="arrow right"></span></a> <ul class="nav-dropdown" style="display:none;"><li class="dropdown-item"><!----> <a href="/06.Tools/01.employment/" class="nav-link">🔖求职</a></li><li class="dropdown-item"><!----> <a href="/06.Tools/02.efficiency/" class="nav-link">🚀效能</a></li><li class="dropdown-item"><!----> <a href="/06.Tools/03.windows/" class="nav-link">⚙️Windows</a></li><li class="dropdown-item"><!----> <a href="/06.Tools/04.design/" class="nav-link">🧩设计</a></li><li class="dropdown-item"><!----> <a href="/06.Tools/05.linux/" class="nav-link">🐉Linux</a></li></ul></div></div><div class="nav-item"><a href="https://github.com/whoway" target="_blank" rel="noopener noreferrer" class="nav-link external">
  GitHub
  <svg xmlns="http://www.w3.org/2000/svg" aria-hidden="true" x="0px" y="0px" viewBox="0 0 100 100" width="15" height="15" class="icon outbound"><path fill="currentColor" d="M18.8,85.1h56l0,0c2.2,0,4-1.8,4-4v-32h-8v28h-48v-48h28v-8h-32l0,0c-2.2,0-4,1.8-4,4v56C14.8,83.3,16.6,85.1,18.8,85.1z"></path> <polygon fill="currentColor" points="45.7,48.7 51.3,54.3 77.2,28.5 77.2,37.2 85.2,37.2 85.2,14.9 62.8,14.9 62.8,22.9 71.5,22.9"></polygon></svg></a></div> <!----></nav></div></header> <div class="sidebar-mask"></div> <div class="sidebar"><nav class="nav-links"><div class="nav-item"><div class="dropdown-wrapper"><a class="dropdown-title"><span class="title">🎓Coding</span> <span class="arrow right"></span></a> <ul class="nav-dropdown" style="display:none;"><li class="dropdown-item"><!----> <a href="/00.Coding/TheBeautyOfProgramming/" class="nav-link">🔖编程之美题解</a></li><li class="dropdown-item"><!----> <a href="/00.Coding/CodeWarehouse/" class="nav-link">🔖代码意识流</a></li></ul></div></div><div class="nav-item"><div class="dropdown-wrapper"><a class="dropdown-title"><span class="title">🚀语言</span> <span class="arrow right"></span></a> <ul class="nav-dropdown" style="display:none;"><li class="dropdown-item"><!----> <a href="/01.Language/Overview/" class="nav-link">🔖概述</a></li><li class="dropdown-item"><!----> <a href="/01.Language/C/" class="nav-link">⭐️C</a></li><li class="dropdown-item"><!----> <a href="/01.Language/Cpp/" class="nav-link">🚀C++</a></li><li class="dropdown-item"><!----> <a href="/01.Language/Java/" class="nav-link">☕️Java</a></li><li class="dropdown-item"><!----> <a href="/01.Language/Python/" class="nav-link">🧩Python3</a></li></ul></div></div><div class="nav-item"><a href="/02.Hardware/" class="nav-link">✔️硬件基础</a></div><div class="nav-item"><div class="dropdown-wrapper"><a class="dropdown-title"><span class="title">⭐️软件基础</span> <span class="arrow right"></span></a> <ul class="nav-dropdown" style="display:none;"><li class="dropdown-item"><!----> <a href="/03.Software/01.DataStructureAndAlgorithm/" class="nav-link">🐾数据结构和算法</a></li><li class="dropdown-item"><!----> <a href="/03.Software/02.OS/" class="nav-link">💻操作系统</a></li><li class="dropdown-item"><!----> <a href="/03.Software/03.Net/" class="nav-link router-link-active">☁️计算机网络</a></li><li class="dropdown-item"><!----> <a href="/03.Software/04.SE/" class="nav-link">✅软件工程</a></li></ul></div></div><div class="nav-item"><a href="/04.Database/" class="nav-link">🎨数据库</a></div><div class="nav-item"><a href="/05.Engineer/" class="nav-link">🔖学术/工程</a></div><div class="nav-item"><div class="dropdown-wrapper"><a class="dropdown-title"><span class="title">⚙️工具</span> <span class="arrow right"></span></a> <ul class="nav-dropdown" style="display:none;"><li class="dropdown-item"><!----> <a href="/06.Tools/01.employment/" class="nav-link">🔖求职</a></li><li class="dropdown-item"><!----> <a href="/06.Tools/02.efficiency/" class="nav-link">🚀效能</a></li><li class="dropdown-item"><!----> <a href="/06.Tools/03.windows/" class="nav-link">⚙️Windows</a></li><li class="dropdown-item"><!----> <a href="/06.Tools/04.design/" class="nav-link">🧩设计</a></li><li class="dropdown-item"><!----> <a href="/06.Tools/05.linux/" class="nav-link">🐉Linux</a></li></ul></div></div><div class="nav-item"><a href="https://github.com/whoway" target="_blank" rel="noopener noreferrer" class="nav-link external">
  GitHub
  <svg xmlns="http://www.w3.org/2000/svg" aria-hidden="true" x="0px" y="0px" viewBox="0 0 100 100" width="15" height="15" class="icon outbound"><path fill="currentColor" d="M18.8,85.1h56l0,0c2.2,0,4-1.8,4-4v-32h-8v28h-48v-48h28v-8h-32l0,0c-2.2,0-4,1.8-4,4v56C14.8,83.3,16.6,85.1,18.8,85.1z"></path> <polygon fill="currentColor" points="45.7,48.7 51.3,54.3 77.2,28.5 77.2,37.2 85.2,37.2 85.2,14.9 62.8,14.9 62.8,22.9 71.5,22.9"></polygon></svg></a></div> <!----></nav>  <ul class="sidebar-links"><li><div class="sidebar-group first"><p class="sidebar-heading open"><span>Wireshark网络分析</span> <!----></p> <ul class="sidebar-group-items"><li><a href="/03.Software/03.Net/Analyse/02.wireshark%E5%9F%BA%E7%A1%80.html#📑目录和单词" class="sidebar-link">📑目录和单词</a><ul class="sidebar-sub-headers"></ul></li><li><a href="/03.Software/03.Net/Analyse/02.wireshark%E5%9F%BA%E7%A1%80.html#_1-wireshark介绍" class="sidebar-link">1.Wireshark介绍</a><ul class="sidebar-sub-headers"><li class="sidebar-sub-header"><a href="/03.Software/03.Net/Analyse/02.wireshark%E5%9F%BA%E7%A1%80.html#（1）过滤演示" class="sidebar-link">（1）过滤演示</a></li><li class="sidebar-sub-header"><a href="/03.Software/03.Net/Analyse/02.wireshark%E5%9F%BA%E7%A1%80.html#（2）wireshark包过滤" class="sidebar-link">（2）wireshark包过滤</a></li></ul></li><li><a href="/03.Software/03.Net/Analyse/02.wireshark%E5%9F%BA%E7%A1%80.html#_2-『伯克利』过滤器介绍" class="sidebar-link">2.『伯克利』过滤器介绍</a><ul class="sidebar-sub-headers"><li class="sidebar-sub-header"><a href="/03.Software/03.Net/Analyse/02.wireshark%E5%9F%BA%E7%A1%80.html#_2-1-概念" class="sidebar-link">2.1.概念</a></li><li class="sidebar-sub-header"><a href="/03.Software/03.Net/Analyse/02.wireshark%E5%9F%BA%E7%A1%80.html#_2-2-语法" class="sidebar-link">2.2.语法</a></li><li class="sidebar-sub-header"><a href="/03.Software/03.Net/Analyse/02.wireshark%E5%9F%BA%E7%A1%80.html#_2-3-自己总结的语法" class="sidebar-link">2.3.自己总结的语法</a></li><li class="sidebar-sub-header"><a href="/03.Software/03.Net/Analyse/02.wireshark%E5%9F%BA%E7%A1%80.html#_2-4-wireshark包过滤器分类：" class="sidebar-link">2.4.wireshark包过滤器分类：</a></li></ul></li><li><a href="/03.Software/03.Net/Analyse/02.wireshark%E5%9F%BA%E7%A1%80.html#_3-『捕获』过滤器『前面』" class="sidebar-link">3.『捕获』过滤器『前面』</a><ul class="sidebar-sub-headers"><li class="sidebar-sub-header"><a href="/03.Software/03.Net/Analyse/02.wireshark%E5%9F%BA%E7%A1%80.html#_3-1-只捕获目标端口为80的tcp数据包" class="sidebar-link">3.1.只捕获目标端口为80的tcp数据包</a></li><li class="sidebar-sub-header"><a href="/03.Software/03.Net/Analyse/02.wireshark%E5%9F%BA%E7%A1%80.html#_3-2-捕获主机p地址为192-168-4-5的数据包" class="sidebar-link">3.2.捕获主机P地址为192.168.4.5的数据包</a></li><li class="sidebar-sub-header"><a href="/03.Software/03.Net/Analyse/02.wireshark%E5%9F%BA%E7%A1%80.html#_3-3-语法很像直接的伯克利表达式" class="sidebar-link">3.3.语法很像直接的伯克利表达式</a></li></ul></li><li><a href="/03.Software/03.Net/Analyse/02.wireshark%E5%9F%BA%E7%A1%80.html#_4-『筛选』过滤器『后面』" class="sidebar-link">4.『筛选』过滤器『后面』</a><ul class="sidebar-sub-headers"></ul></li><li><a href="/03.Software/03.Net/Analyse/02.wireshark%E5%9F%BA%E7%A1%80.html#_5-wireshark捕获输出" class="sidebar-link">5.Wireshark捕获输出</a><ul class="sidebar-sub-headers"><li class="sidebar-sub-header"><a href="/03.Software/03.Net/Analyse/02.wireshark%E5%9F%BA%E7%A1%80.html#_5-1-设置输出文件格式" class="sidebar-link">5.1.设置输出文件格式</a></li><li class="sidebar-sub-header"><a href="/03.Software/03.Net/Analyse/02.wireshark%E5%9F%BA%E7%A1%80.html#_5-2-输出文件位置" class="sidebar-link">5.2.输出文件位置</a></li><li class="sidebar-sub-header"><a href="/03.Software/03.Net/Analyse/02.wireshark%E5%9F%BA%E7%A1%80.html#_5-3-数据流特别大，会导致文件太大，导致wireshark无法正常打开保存的文件" class="sidebar-link">5.3.数据流特别大，会导致文件太大，导致wireshark无法正常打开保存的文件</a></li><li class="sidebar-sub-header"><a href="/03.Software/03.Net/Analyse/02.wireshark%E5%9F%BA%E7%A1%80.html#_5-4-使用wireshark进行网络监控，无论硬盘空间多大都有可能会被消耗殆尽" class="sidebar-link">5.4.使用wireshark进行网络监控，无论硬盘空间多大都有可能会被消耗殆尽</a></li><li class="sidebar-sub-header"><a href="/03.Software/03.Net/Analyse/02.wireshark%E5%9F%BA%E7%A1%80.html#_5-5捕获选项" class="sidebar-link">5.5捕获选项</a></li><li class="sidebar-sub-header"><a href="/03.Software/03.Net/Analyse/02.wireshark%E5%9F%BA%E7%A1%80.html#_5-6-使用文件中的保存" class="sidebar-link">5.6.使用文件中的保存</a></li></ul></li><li><a href="/03.Software/03.Net/Analyse/02.wireshark%E5%9F%BA%E7%A1%80.html#_6-wireshark杂项设置" class="sidebar-link">6.Wireshark杂项设置</a><ul class="sidebar-sub-headers"><li class="sidebar-sub-header"><a href="/03.Software/03.Net/Analyse/02.wireshark%E5%9F%BA%E7%A1%80.html#_6-1-查看wireshark『内置文件』路径" class="sidebar-link">6.1.查看wireshark『内置文件』路径</a></li><li class="sidebar-sub-header"><a href="/03.Software/03.Net/Analyse/02.wireshark%E5%9F%BA%E7%A1%80.html#_6-2-修改wireshark默认配置" class="sidebar-link">6.2.修改wireshark默认配置</a></li></ul></li><li><a href="/03.Software/03.Net/Analyse/02.wireshark%E5%9F%BA%E7%A1%80.html#参考资料" class="sidebar-link">参考资料</a><ul class="sidebar-sub-headers"></ul></li></ul></div></li></ul> </div> <div class="page"> <div class="content"><h1 id="wireshark网络分析"><a href="#wireshark网络分析" class="header-anchor">#</a> Wireshark网络分析</h1> <h2 id="📑目录和单词"><a href="#📑目录和单词" class="header-anchor">#</a> 📑目录和单词</h2> <div class="language-txt line-numbers-mode"><pre class="language-text"><code>## 一、Wireshark介绍
## 二、『伯克利』过滤器介绍
## 三、 Wireshark『捕获』过滤器
## 四、Wireshark『筛选』过滤器
## 五、Wireshark捕获输出
## 六、Wireshark杂项设置
</code></pre> <div class="line-numbers-wrapper"><span class="line-number">1</span><br><span class="line-number">2</span><br><span class="line-number">3</span><br><span class="line-number">4</span><br><span class="line-number">5</span><br><span class="line-number">6</span><br></div></div><div class="language-bash line-numbers-mode"><pre class="language-bash"><code>Capture  n.战利品；l『捕获』；俘虏；占领，『抓取』
filter	v.过滤
</code></pre> <div class="line-numbers-wrapper"><span class="line-number">1</span><br><span class="line-number">2</span><br></div></div><ul><li>wireshark中，比如“抓包 （ packet )”一词本身就不够精确，<strong>Wireshark抓到的应该是帧(frame )</strong>。但是出于表达习惯，我并没有改成“抓帧”。又比如对同一个网络分层的称呼，工程师们也有不同的习惯,希望读者能够接受这些“混乱&quot;。</li></ul> <h2 id="_1-wireshark介绍"><a href="#_1-wireshark介绍" class="header-anchor">#</a> 1.Wireshark介绍</h2> <ul><li>1、功能：网络流量『捕获』和『分析』的软件</li> <li>网络工作者：网络工程师or运维工程师or安全方面人员or，不会wireshark的使用工具，就不是一个合格的网络工作者</li> <li>2、历史：Ethereal是wireshark前身，2006年更名为wireshark，改名的原因是『商标和版权』好像</li> <li>3、原理：由于wireshark会调用咋们这些，底层的网络或功能，从硬件上捕获对应的二进制流量（咋们在网络过程中所有的数据or数据包，都是以0,1序列，这个二进制数据包来传输的。</li></ul> <p>捕获，之后，wireshark内部具有对应的功能转换器，将0，1序列转换或者是组装为1个合法的数据包，然后分析咋们组装好的数据包，识别出，其中的协议，端口，以及目的地等信息。从而使得wireshark捕获之后，会以咋们人类可以识别的方式的这种信息来展示，使得咋们更直观的查看到网络流量。</p> <div class="language-txt line-numbers-mode"><pre class="language-text"><code>1、『捕获』二进制流量
2、『转换』wireshark组装数据包『wireshark内部具有对应的功能转换器』
3、分析捕获的数据包，识别协议等信息

</code></pre> <div class="line-numbers-wrapper"><span class="line-number">1</span><br><span class="line-number">2</span><br><span class="line-number">3</span><br><span class="line-number">4</span><br></div></div><ul><li>4、优势：开源免费，跨平台，可视化『比如tcpdump是命令行』，功能强大『支持的协议特别多，几乎涵盖现在所有已知的所有协议』</li> <li>5、下载安装：官网</li> <li>6、基本使用方式：『4步骤』</li></ul> <div class="language-txr line-numbers-mode"><pre class="language-text"><code>1、选择网卡『因为网络流量是通过网卡在网络当中进行传输，网卡是可以接收流向该网卡或者是在局域网某个网络中的流量，并且接收和发送你要送出的这个数据包
这是流入流出的关键例子，，因为你的计算机可能有多张网卡，
比如，我们最简单的实例，（lo网卡）环回网卡127.0.0.1，其实它也是计算机虚拟出来的一张网卡，
2、捕获数据流量
3、过滤数据包『数据流量捕获之后，我们可能不想查看某些数据流量，此时，我们就可以通过其中的过滤数据包功能，过滤掉某些数据包，只显示我们想要分析的
4、保存数据包『咋们分析完之后，可能获得一个结论，但是你要给别人看，或者是下次分析的时候，你不可能再次抓一次包，因为网络环境在变，下次抓的包很有可能是不同的，为了方便分析，wireshark提供了保存数据包功能
</code></pre> <div class="line-numbers-wrapper"><span class="line-number">1</span><br><span class="line-number">2</span><br><span class="line-number">3</span><br><span class="line-number">4</span><br><span class="line-number">5</span><br><span class="line-number">6</span><br></div></div><p>wireshark在Linux下使用，可以在终端用</p> <div class="language-bash line-numbers-mode"><pre class="language-bash"><code>wireshark
</code></pre> <div class="line-numbers-wrapper"><span class="line-number">1</span><br></div></div><p>打开</p> <div class="language-bash line-numbers-mode"><pre class="language-bash"><code><span class="token function">ifconfig</span> 查看网卡
eth0 是对外的网卡
lo 是本地环回网卡
</code></pre> <div class="line-numbers-wrapper"><span class="line-number">1</span><br><span class="line-number">2</span><br><span class="line-number">3</span><br></div></div><h3 id="（1）过滤演示"><a href="#（1）过滤演示" class="header-anchor">#</a> （1）过滤演示</h3> <p>点击expression，但是我的好像没有</p> <p>只要看http协议，过滤表达式的书写</p> <div class="language-wireshark line-numbers-mode"><pre class="language-text"><code>http
</code></pre> <div class="line-numbers-wrapper"><span class="line-number">1</span><br></div></div><p>然后点击应用，也可能是回车，这样就只看http的了</p> <p>保存前，要停止抓包，保存类似word</p> <p>可以保存的文件后缀</p> <div class="language-txt line-numbers-mode"><pre class="language-text"><code>pcapng

</code></pre> <div class="line-numbers-wrapper"><span class="line-number">1</span><br><span class="line-number">2</span><br></div></div><h3 id="（2）wireshark包过滤"><a href="#（2）wireshark包过滤" class="header-anchor">#</a> （2）wireshark包过滤</h3> <ul><li>wireshark抓包界面介绍：后面操作过程中，会知道我们该在哪找具体的功能。以及如何查看对应的信息</li> <li>伯克利包过滤介绍</li></ul> <p>工具栏下面是个『筛选器』</p> <p>或者说是『筛选过滤器』</p> <p>通过这个可以筛选掉一些无关紧要的内容，使得只显示我们想要查看的某些数据包</p> <p>『所以，我觉得这个名字取得不好，分明是查找我们要的，硬要转个弯说是过滤掉不要的』</p> <p>比如，想要过滤，就使用快捷键<code>Ctr+/</code></p> <h2 id="_2-『伯克利』过滤器介绍"><a href="#_2-『伯克利』过滤器介绍" class="header-anchor">#</a> 2.『伯克利』过滤器介绍</h2> <h3 id="_2-1-概念"><a href="#_2-1-概念" class="header-anchor">#</a> 2.1.概念</h3> <ul><li>伯克利包过滤规则：『这是一种核心思想』</li> <li>BPF(Berkeley Packet Filter)采用与<strong>自然语言相近</strong>的语法，利用语法构造字符串确定<strong>保留</strong>具体符合规则的数据包而忽略其他数据包。</li></ul> <h3 id="_2-2-语法"><a href="#_2-2-语法" class="header-anchor">#</a> 2.2.语法</h3> <p>1、最简单的筛选规则：一个空白字符『无论你任何的数据包都将符合咋们空白字符』这是BPF的基础</p> <p>2、语法规则：『3部分』</p> <div class="language-txt line-numbers-mode"><pre class="language-text"><code>type 表示对象『类似自然语言中的主语』，如IP地址、子网或者端口	host、net、port
dir 表示数据包传输的方向	src、dst
proto 表示与数据包匹配的协议类型	ether、ip、tcp、arp
</code></pre> <div class="line-numbers-wrapper"><span class="line-number">1</span><br><span class="line-number">2</span><br><span class="line-number">3</span><br></div></div><ul><li>其中，IP地址锁定某个具体主机，对应的子网锁定某个范围的多个主机，端口是锁定某个具体的服务『通过它可以确定网络上具体的某个对象』</li></ul> <p>3、语法样例『演示』</p> <h4 id="_1、ip地址"><a href="#_1、ip地址" class="header-anchor">#</a> 1、IP地址</h4> <p>『筛选出，源IP或者目的IP是这个IP地址的』</p> <p>IP地址为192.168.4.5</p> <ul><li>伯克利语法</li></ul> <div class="language-wireshark line-numbers-mode"><pre class="language-text"><code>host 192.168.4.5
</code></pre> <div class="line-numbers-wrapper"><span class="line-number">1</span><br></div></div><p>注意上面的不能直接用，必须用户，我们的IP对应的就是伯克利表示式对应的host后面的</p> <ul><li>wireshark语法</li></ul> <div class="language-bash line-numbers-mode"><pre class="language-bash"><code>ip.addr <span class="token operator">==</span> <span class="token number">192.168</span>.4.5
</code></pre> <div class="line-numbers-wrapper"><span class="line-number">1</span><br></div></div><h4 id="_2、src地址"><a href="#_2、src地址" class="header-anchor">#</a> 2、src地址</h4> <p>源地址为192.168.4.5</p> <div class="language-wireshark line-numbers-mode"><pre class="language-text"><code>src 192.168.4.5
</code></pre> <div class="line-numbers-wrapper"><span class="line-number">1</span><br></div></div><ul><li>wireshark语法</li></ul> <div class="language-bash line-numbers-mode"><pre class="language-bash"><code>ip.src <span class="token operator">==</span> <span class="token number">192.168</span>.3.236
</code></pre> <div class="line-numbers-wrapper"><span class="line-number">1</span><br></div></div><h4 id="_3、dst"><a href="#_3、dst" class="header-anchor">#</a> 3、dst</h4> <p>目的地址簿是192.168.4.5</p> <div class="language-wireshark line-numbers-mode"><pre class="language-text"><code>dst 192.168.4.5
</code></pre> <div class="line-numbers-wrapper"><span class="line-number">1</span><br></div></div><ul><li>wireshark语法</li></ul> <div class="language-bash line-numbers-mode"><pre class="language-bash"><code>ip.dst <span class="token operator">==</span> <span class="token number">192.168</span>.3.236
</code></pre> <div class="line-numbers-wrapper"><span class="line-number">1</span><br></div></div><h4 id="_4、port"><a href="#_4、port" class="header-anchor">#</a> 4、port</h4> <p>目标端口是80</p> <div class="language-bash line-numbers-mode"><pre class="language-bash"><code>dst port <span class="token number">192.168</span>.4.5
</code></pre> <div class="line-numbers-wrapper"><span class="line-number">1</span><br></div></div><p>上面的语法中：所有端口port前面，可以添加tcp或udp</p> <p>比如：udp.port和tcp.port，额，曾前面加tcp啥的，还加了一个.</p> <div class="language-bash line-numbers-mode"><pre class="language-bash"><code>tcp.port <span class="token operator">==</span> <span class="token number">80</span> 
</code></pre> <div class="line-numbers-wrapper"><span class="line-number">1</span><br></div></div><div class="language-bash line-numbers-mode"><pre class="language-bash"><code>tcp.port <span class="token operator">==</span> <span class="token number">80</span> <span class="token operator">||</span> udp.port <span class="token operator">==</span> <span class="token number">80</span>
</code></pre> <div class="line-numbers-wrapper"><span class="line-number">1</span><br></div></div><h4 id="_5、网络范围"><a href="#_5、网络范围" class="header-anchor">#</a> 5、网络范围</h4> <ul><li>伯克利语法</li></ul> <div class="language-bash line-numbers-mode"><pre class="language-bash"><code>net <span class="token number">192.168</span>.4.0/24
</code></pre> <div class="line-numbers-wrapper"><span class="line-number">1</span><br></div></div><p>CIDR『<a href="https://zh.wikipedia.org/zh-hans/%E6%97%A0%E7%B1%BB%E5%88%AB%E5%9F%9F%E9%97%B4%E8%B7%AF%E7%94%B1" target="_blank" rel="noopener noreferrer">无类别域间路由<svg xmlns="http://www.w3.org/2000/svg" aria-hidden="true" x="0px" y="0px" viewBox="0 0 100 100" width="15" height="15" class="icon outbound"><path fill="currentColor" d="M18.8,85.1h56l0,0c2.2,0,4-1.8,4-4v-32h-8v28h-48v-48h28v-8h-32l0,0c-2.2,0-4,1.8-4,4v56C14.8,83.3,16.6,85.1,18.8,85.1z"></path> <polygon fill="currentColor" points="45.7,48.7 51.3,54.3 77.2,28.5 77.2,37.2 85.2,37.2 85.2,14.9 62.8,14.9 62.8,22.9 71.5,22.9"></polygon></svg></a>』，，，表示无域间域名类型转换</p> <p>通过它，可以表示某个网络范围内的所有IP地址或者是主机。</p> <ul><li>wireshark语法</li></ul> <div class="language-bash line-numbers-mode"><pre class="language-bash"><code>ip.addr <span class="token operator">==</span> <span class="token number">192.168</span>.3.0/24
</code></pre> <div class="line-numbers-wrapper"><span class="line-number">1</span><br></div></div><p>上面这样的就能。筛选出，IP地址在对应的子网当中的内容</p> <h4 id="_6、并且和或"><a href="#_6、并且和或" class="header-anchor">#</a> 6、并且和或</h4> <div class="language-bash line-numbers-mode"><pre class="language-bash"><code>tcp.port <span class="token operator">==</span> <span class="token number">80</span> and ip.dst <span class="token operator">==</span> <span class="token number">192.168</span>.3.236
</code></pre> <div class="line-numbers-wrapper"><span class="line-number">1</span><br></div></div><h3 id="_2-3-自己总结的语法"><a href="#_2-3-自己总结的语法" class="header-anchor">#</a> 2.3.自己总结的语法</h3> <ul><li>wireshark语法，感觉是协议.协议内容 == 逻辑关键词（||或and或not）</li></ul> <p>所以，src和dst和ip才是在ip中封装</p> <h3 id="_2-4-wireshark包过滤器分类："><a href="#_2-4-wireshark包过滤器分类：" class="header-anchor">#</a> 2.4.wireshark包过滤器分类：</h3> <ul><li>『捕获』过滤器：是在咋们在<strong>抓包之前</strong>，进行设置，这样wireshark就不会抓获不符合规则的数据包『设置包捕获过滤器的方法：Capture filter for selected interfaces:设置，</li> <li>『筛选』过滤器：是在<strong>抓包之后</strong>，应用的，是『显示过滤器』，我们<strong>前面用的功能都是这种过滤器</strong>！！！</li></ul> <h2 id="_3-『捕获』过滤器『前面』"><a href="#_3-『捕获』过滤器『前面』" class="header-anchor">#</a> 3.『捕获』过滤器『前面』</h2> <ul><li>遵循伯克利过滤器语法规则：也就是说，前面的语法也遵循</li> <li>演示：</li></ul> <h3 id="_3-1-只捕获目标端口为80的tcp数据包"><a href="#_3-1-只捕获目标端口为80的tcp数据包" class="header-anchor">#</a> 3.1.只捕获目标端口为80的tcp数据包</h3> <div class="language-bash line-numbers-mode"><pre class="language-bash"><code>tcp dst port <span class="token number">80</span>
</code></pre> <div class="line-numbers-wrapper"><span class="line-number">1</span><br></div></div><h3 id="_3-2-捕获主机p地址为192-168-4-5的数据包"><a href="#_3-2-捕获主机p地址为192-168-4-5的数据包" class="header-anchor">#</a> 3.2.捕获主机P地址为192.168.4.5的数据包</h3> <div class="language-bash line-numbers-mode"><pre class="language-bash"><code><span class="token function">host</span> <span class="token number">192.168</span>.3.236
</code></pre> <div class="line-numbers-wrapper"><span class="line-number">1</span><br></div></div><p>或者</p> <div class="language-bash line-numbers-mode"><pre class="language-bash"><code>dst <span class="token function">host</span> <span class="token number">192.168</span>.3.236
</code></pre> <div class="line-numbers-wrapper"><span class="line-number">1</span><br></div></div><div class="language-bash line-numbers-mode"><pre class="language-bash"><code>src <span class="token function">host</span> <span class="token number">192.168</span>.3.236
</code></pre> <div class="line-numbers-wrapper"><span class="line-number">1</span><br></div></div><p>注意：捕获过滤器，不支持我们起那么的那只CIDR的书写以及主机名的写法</p> <h3 id="_3-3-语法很像直接的伯克利表达式"><a href="#_3-3-语法很像直接的伯克利表达式" class="header-anchor">#</a> 3.3.语法很像直接的伯克利表达式</h3> <h2 id="_4-『筛选』过滤器『后面』"><a href="#_4-『筛选』过滤器『后面』" class="header-anchor">#</a> 4.『筛选』过滤器『后面』</h2> <ul><li>筛选过滤器，又称『显示过滤器』</li></ul> <p>1、显示过滤器创建『2种方法』</p> <ul><li><p>输入框创建，快捷键Ctrl+/</p></li> <li><div class="language-bash line-numbers-mode"><pre class="language-bash"><code>http.request.full_uri <span class="token operator">==</span> <span class="token string">&quot;www.baidu.com&quot;</span>
</code></pre> <div class="line-numbers-wrapper"><span class="line-number">1</span><br></div></div></li> <li><p>数据包细节面板创建『就是你查看某个包的细节，你右键那个选中，就能选择』</p></li></ul> <p>2、表达式规则</p> <ul><li><p>语法：主题+运算符+值</p></li> <li><div class="language-bash line-numbers-mode"><pre class="language-bash"><code>运算符比如： <span class="token operator">==</span>  <span class="token operator">&gt;</span>  <span class="token operator">&lt;</span>
</code></pre> <div class="line-numbers-wrapper"><span class="line-number">1</span><br></div></div></li> <li><p>逻辑关系（3个）下面6种写法都OK</p></li> <li><div class="language-bash line-numbers-mode"><pre class="language-bash"><code>and or not
<span class="token operator">&amp;&amp;</span> <span class="token operator">||</span> <span class="token operator">!</span>
</code></pre> <div class="line-numbers-wrapper"><span class="line-number">1</span><br><span class="line-number">2</span><br></div></div></li></ul> <p>此外!!:可以使用圆括号来控制了『优先级』</p> <h2 id="_5-wireshark捕获输出"><a href="#_5-wireshark捕获输出" class="header-anchor">#</a> 5.Wireshark捕获输出</h2> <ul><li>捕获的数据包如何进行有规则的保存？</li></ul> <h3 id="_5-1-设置输出文件格式"><a href="#_5-1-设置输出文件格式" class="header-anchor">#</a> 5.1.设置输出文件格式</h3> <ul><li>pcap-ng还是pcap</li></ul> <p>可以在选项中设置。容易</p> <h3 id="_5-2-输出文件位置"><a href="#_5-2-输出文件位置" class="header-anchor">#</a> 5.2.输出文件位置</h3> <h3 id="_5-3-数据流特别大，会导致文件太大，导致wireshark无法正常打开保存的文件"><a href="#_5-3-数据流特别大，会导致文件太大，导致wireshark无法正常打开保存的文件" class="header-anchor">#</a> 5.3.数据流特别大，会导致文件太大，导致wireshark无法正常打开保存的文件</h3> <ul><li>比如用wireshark抓取某个主机流量的时候，可能这个数据特别大。当然你如果在本地不开任何网络程序的话，可能数据量是非常小的，但是如果你监听大型服务器的话，它的数据流量就是特别大的，如果把数据流量保持，此时会导致，无法打开超大量的文件，会出现卡顿</li> <li>解决方案：设置自动创建新文件，每隔10秒创建一个文件。</li> <li><strong>『捕获选项』中修改</strong></li></ul> <h3 id="_5-4-使用wireshark进行网络监控，无论硬盘空间多大都有可能会被消耗殆尽"><a href="#_5-4-使用wireshark进行网络监控，无论硬盘空间多大都有可能会被消耗殆尽" class="header-anchor">#</a> 5.4.使用wireshark进行网络监控，无论硬盘空间多大都有可能会被消耗殆尽</h3> <ul><li><strong>『捕获选项』中修改</strong></li> <li>解决方案:环形缓存器</li></ul> <h3 id="_5-5捕获选项"><a href="#_5-5捕获选项" class="header-anchor">#</a> 5.5捕获选项</h3> <p>显示选项Display option
解析名称Name Resolution
自动停止捕获Automatically scrpll during live capture『比如设置抓20个文件的包，就停止』</p> <h3 id="_5-6-使用文件中的保存"><a href="#_5-6-使用文件中的保存" class="header-anchor">#</a> 5.6.使用文件中的保存</h3> <ul><li>容易，Ctrl+S</li></ul> <h2 id="_6-wireshark杂项设置"><a href="#_6-wireshark杂项设置" class="header-anchor">#</a> 6.Wireshark杂项设置</h2> <ul><li>wireshark中特别边角料，但是也可能绊倒你的杂项设置</li></ul> <h3 id="_6-1-查看wireshark『内置文件』路径"><a href="#_6-1-查看wireshark『内置文件』路径" class="header-anchor">#</a> 6.1.查看wireshark『内置文件』路径</h3> <ul><li>设置，或者说不是用来配置，而是为了来帮助我们找到具体的文件路径的方式。</li> <li>我们可以找到，wireshark的所有相关文件，比如说『它的配置文件』和它的使用到的文件路径</li></ul> <p>还有，我们这个类似的VScode中装的『插件』啥的，都可以在这个里面看到。还可以看『快捷键』</p> <h3 id="_6-2-修改wireshark默认配置"><a href="#_6-2-修改wireshark默认配置" class="header-anchor">#</a> 6.2.修改wireshark默认配置</h3> <ul><li>有的人，发现别人的界面与我们自己的界面不一样</li></ul> <p>我们也可以修改默认配置，右下角切换</p> <h2 id="参考资料"><a href="#参考资料" class="header-anchor">#</a> 参考资料</h2> <ul><li>网络安全<a href="https://www.wangan.com/docs/1006" target="_blank" rel="noopener noreferrer">wireshark中文使用教程<svg xmlns="http://www.w3.org/2000/svg" aria-hidden="true" x="0px" y="0px" viewBox="0 0 100 100" width="15" height="15" class="icon outbound"><path fill="currentColor" d="M18.8,85.1h56l0,0c2.2,0,4-1.8,4-4v-32h-8v28h-48v-48h28v-8h-32l0,0c-2.2,0-4,1.8-4,4v56C14.8,83.3,16.6,85.1,18.8,85.1z"></path> <polygon fill="currentColor" points="45.7,48.7 51.3,54.3 77.2,28.5 77.2,37.2 85.2,37.2 85.2,14.9 62.8,14.9 62.8,22.9 71.5,22.9"></polygon></svg></a></li> <li>W3C中<a href="https://www.w3cschool.cn/wireshark/o71m5ozt.html" target="_blank" rel="noopener noreferrer">wireshark<svg xmlns="http://www.w3.org/2000/svg" aria-hidden="true" x="0px" y="0px" viewBox="0 0 100 100" width="15" height="15" class="icon outbound"><path fill="currentColor" d="M18.8,85.1h56l0,0c2.2,0,4-1.8,4-4v-32h-8v28h-48v-48h28v-8h-32l0,0c-2.2,0-4,1.8-4,4v56C14.8,83.3,16.6,85.1,18.8,85.1z"></path> <polygon fill="currentColor" points="45.7,48.7 51.3,54.3 77.2,28.5 77.2,37.2 85.2,37.2 85.2,14.9 62.8,14.9 62.8,22.9 71.5,22.9"></polygon></svg></a></li> <li>wireshark用户手册，<a href="https://www.ctolib.com/docs/sfile/wireshark-manual/0.html" target="_blank" rel="noopener noreferrer">中文翻译版<svg xmlns="http://www.w3.org/2000/svg" aria-hidden="true" x="0px" y="0px" viewBox="0 0 100 100" width="15" height="15" class="icon outbound"><path fill="currentColor" d="M18.8,85.1h56l0,0c2.2,0,4-1.8,4-4v-32h-8v28h-48v-48h28v-8h-32l0,0c-2.2,0-4,1.8-4,4v56C14.8,83.3,16.6,85.1,18.8,85.1z"></path> <polygon fill="currentColor" points="45.7,48.7 51.3,54.3 77.2,28.5 77.2,37.2 85.2,37.2 85.2,14.9 62.8,14.9 62.8,22.9 71.5,22.9"></polygon></svg></a></li> <li>小林Coding，<a href="https://gitbook.cn/gitchat/activity/5ec68ab2e80cd341fa46d2c0" target="_blank" rel="noopener noreferrer">让你“看见TCP”<svg xmlns="http://www.w3.org/2000/svg" aria-hidden="true" x="0px" y="0px" viewBox="0 0 100 100" width="15" height="15" class="icon outbound"><path fill="currentColor" d="M18.8,85.1h56l0,0c2.2,0,4-1.8,4-4v-32h-8v28h-48v-48h28v-8h-32l0,0c-2.2,0-4,1.8-4,4v56C14.8,83.3,16.6,85.1,18.8,85.1z"></path> <polygon fill="currentColor" points="45.7,48.7 51.3,54.3 77.2,28.5 77.2,37.2 85.2,37.2 85.2,14.9 62.8,14.9 62.8,22.9 71.5,22.9"></polygon></svg></a></li> <li>Github，《计算机网络－自顶向下方法》<a href="http://moranzcw.com/Computer-Networking-A-Top-Down-Approach-NOTES/" target="_blank" rel="noopener noreferrer">实验翻译<svg xmlns="http://www.w3.org/2000/svg" aria-hidden="true" x="0px" y="0px" viewBox="0 0 100 100" width="15" height="15" class="icon outbound"><path fill="currentColor" d="M18.8,85.1h56l0,0c2.2,0,4-1.8,4-4v-32h-8v28h-48v-48h28v-8h-32l0,0c-2.2,0-4,1.8-4,4v56C14.8,83.3,16.6,85.1,18.8,85.1z"></path> <polygon fill="currentColor" points="45.7,48.7 51.3,54.3 77.2,28.5 77.2,37.2 85.2,37.2 85.2,14.9 62.8,14.9 62.8,22.9 71.5,22.9"></polygon></svg></a></li> <li>wireshark官网的<a href="https://www.wireshark.org/docs/wsdg_html_chunked/" target="_blank" rel="noopener noreferrer">开发者指南<svg xmlns="http://www.w3.org/2000/svg" aria-hidden="true" x="0px" y="0px" viewBox="0 0 100 100" width="15" height="15" class="icon outbound"><path fill="currentColor" d="M18.8,85.1h56l0,0c2.2,0,4-1.8,4-4v-32h-8v28h-48v-48h28v-8h-32l0,0c-2.2,0-4,1.8-4,4v56C14.8,83.3,16.6,85.1,18.8,85.1z"></path> <polygon fill="currentColor" points="45.7,48.7 51.3,54.3 77.2,28.5 77.2,37.2 85.2,37.2 85.2,14.9 62.8,14.9 62.8,22.9 71.5,22.9"></polygon></svg></a></li> <li>C语言中文网-<a href="http://c.biancheng.net/view/6379.html" target="_blank" rel="noopener noreferrer">wireshark安装<svg xmlns="http://www.w3.org/2000/svg" aria-hidden="true" x="0px" y="0px" viewBox="0 0 100 100" width="15" height="15" class="icon outbound"><path fill="currentColor" d="M18.8,85.1h56l0,0c2.2,0,4-1.8,4-4v-32h-8v28h-48v-48h28v-8h-32l0,0c-2.2,0-4,1.8-4,4v56C14.8,83.3,16.6,85.1,18.8,85.1z"></path> <polygon fill="currentColor" points="45.7,48.7 51.3,54.3 77.2,28.5 77.2,37.2 85.2,37.2 85.2,14.9 62.8,14.9 62.8,22.9 71.5,22.9"></polygon></svg></a></li> <li>[美]Chris Sanders，《<a href="https://book.douban.com/subject/21691692/" target="_blank" rel="noopener noreferrer">Wireshark数据包分析实战<svg xmlns="http://www.w3.org/2000/svg" aria-hidden="true" x="0px" y="0px" viewBox="0 0 100 100" width="15" height="15" class="icon outbound"><path fill="currentColor" d="M18.8,85.1h56l0,0c2.2,0,4-1.8,4-4v-32h-8v28h-48v-48h28v-8h-32l0,0c-2.2,0-4,1.8-4,4v56C14.8,83.3,16.6,85.1,18.8,85.1z"></path> <polygon fill="currentColor" points="45.7,48.7 51.3,54.3 77.2,28.5 77.2,37.2 85.2,37.2 85.2,14.9 62.8,14.9 62.8,22.9 71.5,22.9"></polygon></svg></a>》</li> <li>林沛满，《<a href="https://book.douban.com/subject/26268767/" target="_blank" rel="noopener noreferrer">Wireshark网络分析就这么简单<svg xmlns="http://www.w3.org/2000/svg" aria-hidden="true" x="0px" y="0px" viewBox="0 0 100 100" width="15" height="15" class="icon outbound"><path fill="currentColor" d="M18.8,85.1h56l0,0c2.2,0,4-1.8,4-4v-32h-8v28h-48v-48h28v-8h-32l0,0c-2.2,0-4,1.8-4,4v56C14.8,83.3,16.6,85.1,18.8,85.1z"></path> <polygon fill="currentColor" points="45.7,48.7 51.3,54.3 77.2,28.5 77.2,37.2 85.2,37.2 85.2,14.9 62.8,14.9 62.8,22.9 71.5,22.9"></polygon></svg></a>》</li> <li>51CTO，<a href="https://edu.51cto.com/course/18664.html" target="_blank" rel="noopener noreferrer">Wireshark网络分析实践<svg xmlns="http://www.w3.org/2000/svg" aria-hidden="true" x="0px" y="0px" viewBox="0 0 100 100" width="15" height="15" class="icon outbound"><path fill="currentColor" d="M18.8,85.1h56l0,0c2.2,0,4-1.8,4-4v-32h-8v28h-48v-48h28v-8h-32l0,0c-2.2,0-4,1.8-4,4v56C14.8,83.3,16.6,85.1,18.8,85.1z"></path> <polygon fill="currentColor" points="45.7,48.7 51.3,54.3 77.2,28.5 77.2,37.2 85.2,37.2 85.2,14.9 62.8,14.9 62.8,22.9 71.5,22.9"></polygon></svg></a>，Xmind版</li></ul></div> <div class="page-edit"><!----> <!----></div> <!----> </div> <!----></div></div>
    <script src="/assets/js/app.c70e21ad.js" defer></script><script src="/assets/js/79.ef71713f.js" defer></script>
  </body>
</html>
